qakbot | a52055bbd8080327a589accea860cf70e3a79b35d7173c5305e92e3852843fe7

General

Target

387f24bf87926db742020021902c80b7_JaffaCakes118.dll
Size

708KB
MD5

387f24bf87926db742020021902c80b7
SHA1

e6e7718b875a84cb91217f90d09b24cdac60e36a
SHA256

a52055bbd8080327a589accea860cf70e3a79b35d7173c5305e92e3852843fe7
SHA512

6ca8e6fe88324d151b78f1ed6c4760327a5a4776244dc4d5ff620f5432c796a1746ca58d16a6c040b28d45b31436e38365deeaf7f5f3891d8fdb018e4d359711
SSDEEP

12288:F9bAcis08s7gQFMWC24/MFS+AWmdXWJIjJ5F3+DpEFs3H6v/+NoTNA:F1Dis0dFA24/MFSptoJKnx+NE23a3+NV

Score

10^/10

qakbot obama106 1632905607 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama106

Campaign

1632905607

C2

37.210.152.224:995

120.151.47.189:443

105.198.236.99:443

122.11.220.212:2222

199.27.127.129:443

41.251.41.14:995

216.201.162.158:443

124.123.42.115:2078

181.118.183.94:443

120.150.218.241:995

185.250.148.74:443

217.17.56.163:443

182.181.78.18:995

140.82.49.12:443

105.159.144.186:995

89.101.97.139:443

217.17.56.163:0

27.223.92.142:995

95.77.223.148:443

109.190.253.11:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Heistyranfwu = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Gjcwtbn = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

4572 regsvr32.exe

pid	process
4572	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

regsvr32.exeexplorer.exerundll32.exeexplorer.exeschtasks.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wcifymvyjesf\5119a105 = 97af1212faa16b69a49a61de6302ff40cbec905311a3327994c80e322ee1166f0374e6fb9aba69d7	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wcifymvyjesf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wcifymvyjesf\1bcf1ebd = 11bffd6b4de4ee94c290bfeded021990b74b40f7bb5b8b6b8aad202830a283eb82e41195bce8e5b1a4744f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wcifymvyjesf\2e50cef3 = 87253c7f070687a04ff60102b6f4c8d862f06b6d4264469dd23d19add4270387cd8ce49b4c6135ef06283f27518497ea2e4d4e5c14001a6bc21713733622268818d36d179b98a79060efc83a2c18209d2e8806f6de83f96e2499decdae9b3b5c52a72a74e67a68d74fa1cc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wcifymvyjesf\2c11ee8f = 4726c8a726af0994c6c780f243a9ed	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wcifymvyjesf\94ad89ea = 579803698ef88df0a3367b9e272855126a74817f80cb9361ea2e4caf069a27272b52d086918a7abc6764db8762bdb1d53506e4c609928eb7d86b8065a0e2026a3784ef3296	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wcifymvyjesf\e9a5c660 = 154782996bbf7dabcd652a6984c76fc5233993fea33a69ff0a12cac1e770276c0ba390b039	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wcifymvyjesf\96eca996 = dea845533dc19d48e2f26acaf23062	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wcifymvyjesf\6486714b = 70318e6c6f39307f764d7d39983dd4c6194ccf2535b3360ab3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wcifymvyjesf\1bcf1ebd = 11bfea6b4de4db6d62d0afc3b5275b02aacced577d1466617a3f8ecefa7d89c71a503bb7504a9b681970bc0b85819a5453c3f1bd7c4bbf3fc084b02a51e1a07a	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2192 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

3396 rundll32.exe
3396 rundll32.exe
4572 regsvr32.exe
4572 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

3396 rundll32.exe
4572 regsvr32.exe

pid	process
2192	schtasks.exe

pid	process
3396	rundll32.exe
3396	rundll32.exe
4572	regsvr32.exe
4572	regsvr32.exe

pid	process
3396	rundll32.exe
4572	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2780 wrote to memory of 3396	2780	rundll32.exe	rundll32.exe
PID 2780 wrote to memory of 3396	2780	rundll32.exe	rundll32.exe
PID 2780 wrote to memory of 3396	2780	rundll32.exe	rundll32.exe
PID 3396 wrote to memory of 1480	3396	rundll32.exe	explorer.exe
PID 3396 wrote to memory of 1480	3396	rundll32.exe	explorer.exe
PID 3396 wrote to memory of 1480	3396	rundll32.exe	explorer.exe
PID 3396 wrote to memory of 1480	3396	rundll32.exe	explorer.exe
PID 3396 wrote to memory of 1480	3396	rundll32.exe	explorer.exe
PID 1480 wrote to memory of 2192	1480	explorer.exe	schtasks.exe
PID 1480 wrote to memory of 2192	1480	explorer.exe	schtasks.exe
PID 1480 wrote to memory of 2192	1480	explorer.exe	schtasks.exe
PID 3464 wrote to memory of 4572	3464	regsvr32.exe	regsvr32.exe
PID 3464 wrote to memory of 4572	3464	regsvr32.exe	regsvr32.exe
PID 3464 wrote to memory of 4572	3464	regsvr32.exe	regsvr32.exe
PID 4572 wrote to memory of 1820	4572	regsvr32.exe	explorer.exe
PID 4572 wrote to memory of 1820	4572	regsvr32.exe	explorer.exe
PID 4572 wrote to memory of 1820	4572	regsvr32.exe	explorer.exe
PID 4572 wrote to memory of 1820	4572	regsvr32.exe	explorer.exe
PID 4572 wrote to memory of 1820	4572	regsvr32.exe	explorer.exe
PID 1820 wrote to memory of 1660	1820	explorer.exe	reg.exe
PID 1820 wrote to memory of 1660	1820	explorer.exe	reg.exe
PID 1820 wrote to memory of 4012	1820	explorer.exe	reg.exe
PID 1820 wrote to memory of 4012	1820	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\387f24bf87926db742020021902c80b7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\387f24bf87926db742020021902c80b7_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1480
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn phfnyzaq /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\387f24bf87926db742020021902c80b7_JaffaCakes118.dll\"" /SC ONCE /Z /ST 04:58 /ET 05:10
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2192

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\387f24bf87926db742020021902c80b7_JaffaCakes118.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\387f24bf87926db742020021902c80b7_JaffaCakes118.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Gjcwtbn" /d "0"
      4⤵
      Windows security bypass
      PID:1660
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Heistyranfwu" /d "0"
      4⤵
      Windows security bypass
      PID:4012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\387f24bf87926db742020021902c80b7_JaffaCakes118.dll

Filesize
708KB

MD5
387f24bf87926db742020021902c80b7

SHA1
e6e7718b875a84cb91217f90d09b24cdac60e36a

SHA256
a52055bbd8080327a589accea860cf70e3a79b35d7173c5305e92e3852843fe7

SHA512
6ca8e6fe88324d151b78f1ed6c4760327a5a4776244dc4d5ff620f5432c796a1746ca58d16a6c040b28d45b31436e38365deeaf7f5f3891d8fdb018e4d359711

Download Submit
memory/1480-11-0x00000000009A0000-0x00000000009C1000-memory.dmp

Filesize
132KB

Download
memory/1480-12-0x00000000009A0000-0x00000000009C1000-memory.dmp

Filesize
132KB

Download
memory/1480-10-0x00000000009A0000-0x00000000009C1000-memory.dmp

Filesize
132KB

Download
memory/1480-6-0x00000000009A0000-0x00000000009C1000-memory.dmp

Filesize
132KB

Download
memory/1480-14-0x00000000009A0000-0x00000000009C1000-memory.dmp

Filesize
132KB

Download
memory/1820-23-0x00000000005A0000-0x00000000005C1000-memory.dmp

Filesize
132KB

Download
memory/1820-25-0x00000000005A0000-0x00000000005C1000-memory.dmp

Filesize
132KB

Download
memory/1820-24-0x00000000005A0000-0x00000000005C1000-memory.dmp

Filesize
132KB

Download
memory/3396-5-0x00000000748D0000-0x000000007499A000-memory.dmp

Filesize
808KB

Download
memory/3396-4-0x0000000074981000-0x0000000074987000-memory.dmp

Filesize
24KB

Download
memory/3396-0-0x00000000748D0000-0x000000007499A000-memory.dmp

Filesize
808KB

Download
memory/3396-7-0x00000000748D0000-0x000000007499A000-memory.dmp

Filesize
808KB

Download
memory/3396-1-0x00000000748D0000-0x000000007499A000-memory.dmp

Filesize
808KB

Download
memory/4572-18-0x0000000074840000-0x000000007490A000-memory.dmp

Filesize
808KB

Download
memory/4572-19-0x0000000074840000-0x000000007490A000-memory.dmp

Filesize
808KB

Download
memory/4572-21-0x0000000074840000-0x000000007490A000-memory.dmp

Filesize
808KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads